req.body.title`), or use `$jsonSchema` database validation (Chapter 18).

# CHAPTER 25

Building CRUD Applications with MongoDB #

1. Introduction #

2. Learning Objectives #

• Map HTTP REST methods to MongoDB operations.

• Implement the "Create" operation using POST and insertOne().

• Implement the "Read" operation using GET and find().

• Implement the "Update" operation using PUT and updateOne().

• Implement the "Delete" operation using DELETE and deleteOne().

• Architect a clean, secure API workflow.

3. The Architecture Map (REST API) #

• Create: Browser sends POST /tasks -> Express runs insertOne().

• Read: Browser sends GET /tasks -> Express runs find().

• Update: Browser sends PUT /tasks/:id -> Express runs updateOne().

• Delete: Browser sends DELETE /tasks/:id -> Express runs deleteOne().

4. Step 1: The Express Setup #

const express = require('express');
const { MongoClient, ObjectId } = require('mongodb');

const app = express();
app.use(express.json()); // Allows Express to read JSON body payloads

let db;
MongoClient.connect("mongodb://localhost:27017")
    .then(client => {
        db = client.db("task_manager");
        app.listen(3000, () => console.log("Server running on port 3000"));
    });

5. Step 2: C - CREATE (Adding a Task) #

app.post('/tasks', async (req, res) => {
    try {
        const newTask = {
            title: req.body.title,
            status: "Pending", // Default value
            created_at: new Date()
        };
        
        const result = await db.collection("tasks").insertOne(newTask);
        res.status(201).json({ message: "Task created!", id: result.insertedId });
    } catch (error) {
        res.status(500).json({ error: "Could not create task." });
    }
});

6. Step 3: R - READ (Fetching Tasks) #

app.get('/tasks', async (req, res) => {
    try {
        // Fetch all tasks, sort newest first, and convert cursor to Array!
        const tasks = await db.collection("tasks")
                              .find()
                              .sort({ created_at: -1 })
                              .toArray();
                              
        res.status(200).json(tasks);
    } catch (error) {
        res.status(500).json({ error: "Could not fetch tasks." });
    }
});

7. Step 4: U - UPDATE (Editing a Task) #

app.put('/tasks/:id', async (req, res) => {
    try {
        const targetId = new ObjectId(req.params.id);
        const updatedStatus = req.body.status;
        
        const result = await db.collection("tasks").updateOne(
            { _id: targetId },
            { $set: { status: updatedStatus } }
        );
        
        res.status(200).json({ message: "Task updated successfully!" });
    } catch (error) {
        res.status(500).json({ error: "Could not update task." });
    }
});

8. Step 5: D - DELETE (Removing a Task) #

app.delete('/tasks/:id', async (req, res) => {
    try {
        const targetId = new ObjectId(req.params.id);
        
        const result = await db.collection("tasks").deleteOne({ _id: targetId });
        
        if (result.deletedCount === 1) {
            res.status(200).json({ message: "Task permanently deleted." });
        } else {
            res.status(404).json({ error: "Task not found." });
        }
    } catch (error) {
        res.status(500).json({ error: "Could not delete task." });
    }
});

9. Common Mistakes #

• Dumping req.body directly into MongoDB: It is highly dangerous to write insertOne(req.body). If a hacker sends {"title": "Hack", "isadmin": true} in the body, your database blindly saves it. Always manually destruct and validate the fields you expect (e.g., title: req.body.title), or use $jsonSchema database validation (Chapter 18).

• Soft Deletes: In enterprise applications, we rarely use physical DELETE requests. Instead, we use a PUT request to update a boolean column: { $set: { isdeleted: true } }. The "Read" script is modified to find({ is_deleted: false }). The data appears deleted to the user, but is preserved for auditing!

11. Exercises #

1. 1. Which HTTP method and MongoDB method combination is used for the "Create" operation?

1. 2. Why must req.params.id be converted before it can be used in a updateOne() filter?

12. MongoDB Challenges #

app.get('/tasks/:id', async (req, res) => {
    const task = await db.collection("tasks").findOne({ _id: new ObjectId(req.params.id) });
    res.json(task);
});

13. MCQ Quiz with Answers #

14. Interview Questions #

• Q: Explain the concept of a "Soft Delete" versus a "Hard Delete" in database architecture. Why do enterprise systems heavily favor soft deletes?

• Q: You are reviewing a junior developer's code. They wrote db.collection('users').insertOne(req.body). Explain the catastrophic security vulnerability (NoSQL Injection/Mass Assignment) present in this code, and how to fix it.

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #